As used herein, “malicious computer code” is any code that enters a computer without the knowledge and/or consent of an authorized user of the computer and/or a system administrator of an enterprise incorporating the computer. Thus, “malicious computer code” encompasses, but is not limited to, viruses, worms, Trojan horses, spam, adware, and unwanted popups.
With reference to FIG. 1, when a local computer 10 wishes to open a computer file 14 over a network 15 (i.e., the file 14 is located on or otherwise associated with a remote computer 12 that is coupled to the local computer 10 over the network 15), safety dictates that the file 14 be scanned for the presence of malicious code before the file 14 is opened. Otherwise, the local computer 10 may be infected with malicious code. In conventional systems, a real-time malicious code scanning module 11 associated with the local computer 10 scans the file 14 over the network 15 before the local computer 10 opens the file 14. This is slow and cumbersome, and generates a lot of unwanted network traffic. A scanned file cache 17 associated with the local computer 10 cannot be safely relied upon to verify that the file 14 on the remote computer 12 is free of malicious code. This is because the local computer 10 has no way of tracking changes (e.g., tampering) made to file 14 by the remote computer 12 itself or by any other computer on the network 15 after scanning module 11 completes its scan. Therefore, file 14 cannot be placed in the cache 17 associated with the local computer 10. Since file 14 cannot be safely placed in the cache 17, file 14 it must be scanned every time it is accessed.
What is needed is a technique to reduce the time required to open files that are located remotely, to reduce network traffic, and to reduce the load on the remote computer 12 for handling the extra input and output generated when malicious code scans are done by the local computer 10. These goals are achieved by the present invention.